refactor(storage): extract runner configuration stores

[edersonbrilhante]

Description

• Introduce provider-neutral RunnerConfigStore, RunnerGroupCacheStore, and GitHubAppCredentialsStore contracts.
• Keep aws_ssm as the default for RUNNER_CONFIG_STORAGE_PROVIDER.
• Move token/JIT writes, runner-group caching, runner-config housekeeping, and GitHub App credential reads into the SSM provider implementation.
• Keep generic metadata provider-neutral; the SSM adapter alone maps metadata to AWS tags.
• Remove ssmTokenPath, ssmConfigPath, SSM tag configuration, and direct SSM credential reads from compute-provider and control-plane code.

Existing SSM behavior is preserved: SecureString create-only runner records, plaintext create-only group IDs, legacy paths, configured tag ordering, 40-write pacing, scheduled cleanup, and one batched/decrypted multi-app credential read. The existing ssmHousekeeper Lambda export and Terraform handlers remain unchanged. No Terraform, IAM, or resource changes are included.

Test Plan

• Full Lambda Vitest suite: 56 files / 877 tests passed.
• Scale-up tests use provider-neutral store mocks; SSM tag-to-command behavior is covered by the SSM utility tests.
• Auth and rate-limit tests use provider-neutral credential access; SSM parameter parsing and decoding are covered by the provider tests.
• Storage-provider, control-plane, and SSM utility TypeScript checks passed.
• Focused ESLint and Prettier checks passed.
• Control-plane NCC production bundle built successfully.
• git diff --check and commit hooks passed.

Related Issues

• Related storage-backend work: feat: add optional DynamoDB runner config storage #5266

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 4 package(s) with unknown licenses.

See the Details below.

License Issues

lambdas/functions/control-plane/package.json

Package	Version	License	Issue Type
@aws-github-runner/storage-providers		Null	Unknown License

lambdas/libs/storage-providers/package.json

Package	Version	License	Issue Type
@aws-github-runner/aws-powertools-util		Null	Unknown License
@aws-github-runner/aws-ssm-util		Null	Unknown License
@aws-sdk/client-ssm	^3.1009.0	Null	Unknown License

OpenSSF Scorecard

Package	Version	Score	Details
npm/@aws-github-runner/storage-providers		Unknown	Unknown
npm/@aws-github-runner/aws-powertools-util		Unknown	Unknown
npm/@aws-github-runner/aws-ssm-util		Unknown	Unknown
npm/@aws-sdk/client-ssm	^3.1009.0	Unknown	Unknown
npm/aws-sdk-client-mock	^4.1.0	Unknown	Unknown
npm/aws-sdk-client-mock-jest	^4.1.0	Unknown	Unknown

Scanned Files

• lambdas/functions/control-plane/package.json
• lambdas/libs/storage-providers/package.json